Posted
by
Soulskill
on Tuesday July 09, 2013 @03:14PM
from the he-hacked-the-last-donut dept.

snydeq writes "InfoWorld's Roger Grimes interviews a longtime friend and cyber warrior under contract with the U.S. government, offering a fascinating glimpse of the front lines in the ever-escalating and completely clandestine cyber war. From the interview: 'They didn't seem to care that I had hacked our own government years ago or that I smoked pot. I wasn't sure I was going to take the job, but then they showed me the work environment and introduced me to a few future co-workers. I was impressed. ... We have tens of thousands of ready-to-use bugs in single applications, single operating systems. ... It's all zero-days. Literally, if you can name the software or the controller, we have ways to exploit it. There is no software that isn't easily crackable. In the last few years, every publicly known and patched bug makes almost no impact on us. They aren't scratching the surface.'"

Makes sense to me. Software/hardware vulnerabilities are worthless once patched. If this group is tasked with having a way into any system, their main focus is going to be to not-only find exploits, but also to protect those exploits for future use. I have no doubt that such a group exists, and that their collection of exploits is extensive.

Hopefully those exploits are used against our enemies and not against us, but that's probably just a silly hope.

Hopefully those exploits are used against our enemies and not against us, but that's probably just a silly hope.

What enemy? China? Don't make me laugh.

Nah; anyone who has been following security-related news stories for at least a few years understands that the primary enemy of any government is its own citizens. They're nearby, where they can vote against you, take you to court, or shoot at you. None of these threats are easily available to people in other countries.

Just dig into the histories of the related US agencies (e.g., HUAC or the FBI or even the CIA) in the 1950s, 60s and 70s. How many external "enemies" -- or domestic "subversives" -- did they ever catch and prosecute? Pretty close to none at all. How many citizens did they attack and serious injure (either their reputation, finances, or physical well-being)? Lots and lots of them.

This story is only news to someone who isn't familiar with the long, documented history of such activities. Fact is, your government considers you more of a threat than pretty much anyone outside its borders. This is especially true if you're involved in any activity that threatens the income (especially under-the-counter income) of anyone in your government.

Though ultimately more than 3,000 people—mostly within the NSA—were read into the program, the initial secrecy around it was so intense that, notoriously, even the NSA’s own lawyers weren’t allowed to see the legal reasoning justifying it until 2004—something NSA officials themselves found strange.

That secrecy meant that the NSA’s own Inspector General—the agency’s primary internal watchdog—wasn’t cleared to know about the program until August 2002, nearly a year after it began. Even that appears to have been a reluctant concession; NSA Director Michael Hayden had to “make a case” to the White House for reading the IG in. As a result, it was not until February 2003 that the IG “learned of PSP incidents or violations that had not been reported to overseers as required, because none had the clearance to see the report.” The precise nature of those “incidents or violations” remains unknown.

If it's used against "us" then the likelihood of it being detected and disclosed is too high. They can't utilize these exploits carte blanche, but would have to save them only for specific targets, and still they face the risk of compromising an exploit every time it's used. Any evidence collected in this manner is not usable in court either, so it's really only useful for the spy game against high value foreign targets.

If it's used against "us" then the likelihood of it being detected and disclosed is too high. They can't utilize these exploits carte blanche, but would have to save them only for specific targets, and still they face the risk of compromising an exploit every time it's used. Any evidence collected in this manner is not usable in court either, so it's really only useful for the spy game against high value foreign targets.

You're assuming that such use is detected and that people capable of creating a countermeasure are informed. Current technologies utilize a number of honeypots and detection networks to catch new releases into the public networks, but if something like Stuxnet is released and is targetted and doesn't infect many systems, the odds of it being picked up, identified as malicious, and a countermeasure devised, are all remote.

This assumption means that you (incorrectly) are basing your security on the idea that

i read the fine article and he was working on software that finds flaws called a fuzzerhttp://en.wikipedia.org/wiki/Fuzz_testing [wikipedia.org] with the eminent arrival of computer intelligence software that automatically detects and rewrites zero day exploits is soon at hand. then it will be systemically used against everyone at the speed of light to all spheres with computers on them thorough the entire galaxy. just look at modern game engines, if a simple chip or two lets you run a complex 3-d world with billions of ope

Keep in mind: software vulnerabilities exist not because it's impossible to create perfect code, they exist because it's financially impractical. When something as deterministic and self-accountable as artificial intelligence is writing the code, those economies of scale will invalidate that statement.

That was actually my biggest gripe about the Terminator movies... computers wouldn't miss that frequently.

I disagree most real world exploits are configuration specific and further behind hardened network defenses. Our code is shit, but our router and switch are solid. I somehow doubt that the government has secret cisco buffer overflows that were over looked by millions of security researchers since the beginning of computing.

I somehow doubt that the government has secret cisco buffer overflows that were over looked by millions of security researchers since the beginning of computing.

I used to doubt that Windows could be full of thousands of security vulnerabilities that had been overlooked by millions of security researchers so far, and yet. Every month, the privately disclosed 0-days just keep coming.

And those are just the ones that a) white hats have chosen to disclose to Microsoft rather than the NSA/competitors/Russian Mafia, and b) Microsoft has been given the greenlight from the NSA to patch.

Cisco's source code is secret and so is their security remediation process, so we've got

This is about population control, not hypotetical enemies. You critizice something the government or any of their protegees do, then you are a potential threat, no matter how fair or obvious is your critic or complaint. And anything they collect could be used to silence you.

Right on sneaking it in, but a computer can detect when somethings connected to it and each of those devices has a unique ID, at least in windows... there's enterprise software that blocks the device and sends an alert when its plugged into a computer.

These types of software are pretty costly and smart and have been around for a long time.

A better bet would be a micro camera to take code screen shots, but that's not an easy one to not get caught on.

Lol. I'd just synthesize a camera from available parts...and go the microfiche route (store the film inside the suit I'm wearing...do it right, it's flexible, and who is going to rip open the shoulder pads / inner lining of a $2000 suit? If they're wrong, that's $2K from the security budget.) Meh...actually, if I used cellphone filters / trickery, I could collapse the data somewhat holographically...maybe (who is going to question the use of a cellphone wrapper on your person if you bring in / acquire some

Sounds like an invitation for a drone strike. Of course it will be a US drone, probably one operated by a police department or other less tech savvy agency. Someone on the other side of the cyber-war will take control and crash it into his house.

Boasting or not, I think everyone that speaks out about pervasive surveillance techniques should be paid attention. Whether or not their information is accurate, relevant or factual should be decided by ourselves. The NSA has shown us that they cannot be trusted to do anything but lie. If we are to get any accurate information, we have to start taking all perspectives into account, even those of the NSA shills, as they provide contrast.

Once again we have Anachragnome posting his crackpot conspiracy theories about me. If you bothered reading his post above and find it persuasive, then you should read this post [slashdot.org] of his, and note this line:

This is East Germany, all over again--the NSA literally has us spying on each other, inadvertently or not.

Anachragnome seems to think that everyone is spying for the NSA. Who is it doing all this mutual spying? If you stop and think for even a moment you realize that the idea is nonsense. But it does play into his fear inducing agenda, including attempts to make people suspicious and fear me. He is engaging in the very same sort of behavior he is complaining about. By spreading fear he hopes to control people, to stamp out opinions he finds disagreeable, and control discussions. Ask yourself - are you living in fear? I don't. And yet he seems to want you to. Why?

Anachragnome seems to find great significance, even to the point of it being evidence that I am a government agent, that I have a different viewpoint, a minority viewpoint among the population of posters on Slashdot. For some reason he can't accept that different viewpoints don't constitute a conspiracy. What is the purpose of having civil rights if we all have to believe the same thing? I thought that was what fascism was about.

Further evidence that his claims are nonsense is the fact that he thinks that I am both an NSA plant and that I have multiple accounts named with a common theme, no doubt including the recently created troll accounts that have been trying to harass me of late (coid fjord [slashdot.org], and co1d fjord [slashdot.org]). That would seem to be pretty pathetic tradecraft if that were the case. His view is just another sad example of a crank seeing a pattern in the noise [scientificamerican.com] that doesn't really exist, and thinking it significant. Go ahead and read from the two troll accounts. I don't think you'll find much evidence to support Anachragnome's nonsense view. (If you think you have, read more of the thread and check UIDs.)

Apparently the only people that disagree with him are spies. Bow to his power, or you may be branded a "shill" and "forum breaker." Submit to his fear. [slashdot.org] He expects you to inform on each other. Obey him, or you may be branded a traitor too.

Or maybe he is just a crank full of suspicion and fear that should be ignored. Take your pick.

It sounds like reality. Do you really think that every month or two when Adobe or Oracle patches a remote exploit that's in 90% of computers it's a bug introduced within the last patch cycle? Of course not. Software is riddled with bugs and they're found incrementally. If you can find bugs faster than the public researchers you will have a database of zero-days, end of story.

Clearly boasting. "We can break anything easily". Sounds like standard small skills and large ego. [Ref.: google("Incompetent and unaware of it")] Things like PostFix, OpenSSH, Linux Netfilter or xBSD PF, PGP/GnuPG, etc. have been on the exposed surface for a long time and did not have critical vulnerabilities (if configured sanely) for a long time.

Of course, I immediately believe that the usual commercial trash with no security architecture and a test&fix approach to security is easily exploitable in m

I call BS on that guy. He claims there are 5000 people working there. At $100k/year salaries (and it's probably more), that puts this program up to at least $1 billion dollars per year for payroll and equipment. I would assume there is some accounting for that kind of spending.

The US spends upwards of $500B on "Defense" each year... Do you really think a missing $1B would get noticed here and there?

I call BS on that guy. He claims there are 5000 people working there. At $100k/year salaries (and it's probably more), that puts this program up to at least $1 billion dollars per year for payroll and equipment. I would assume there is some accounting for that kind of spending.

LOL, if you're assuming that there's oversight in the government then you haven't been paying attention.

From the summary, "They didn't seem to care that I had hacked our own government years ago or that I smoked pot". I call BS on any notion that the federal government intelligence agencies would hire anyone with a background rife with illegal activity. For every Kevin Mitnick, a convicted person now with a felony record, hired there are thousands of applicants rejected because of a small infraction or deviant behavior, including a preference not to socialize outside of the workplace.

I have a story to tell. (yes, it's relevant).

When I served in the Army I was stationed with an individual that was in the process of getting kicked out. He had been an E4 and had managed to hack into some of NSA's servers (the events took place both before I arrived, and before I knew a damn thing about computers, so I don't know the vector or what his actual abilities are). He created some bogus accounts and used those accounts to send overly critical emails to Generals, signed with a pseudonym, of course. Well, by the time I got there he had already been busted - and like Manning got busted down to an E1 before they kicked him out (dishonorable discharge, of course). Within a month of him getting kicked out NSA directly hired him, paying him far more than he could have ever been paid had he stayed in the service.

The Government ignores laws when it's convenient for them to do so, even when it comes to their own hiring policies.

The Government ignores laws when it's convenient for them to do so, even when it comes to their own hiring policies.

Of course. Utterly strict policies are a bad idea in business or government because the world is always more nusnced. I happen to agree with them on this point that firstly it's better to have them inside the tent pissing out rather than outside pissing in and secondly the old expression"poacher turned gamekeeper" applies very well because it seems that now as ever, the best poachers know the

Dude, it depends if things are an employer's market, or an employee's market. If the US government needs a cracker that can slice through security like a hot knife through butter, and their choices are John Convict, or Joe Non-Convict, with the former being capable, and the latter not so much...well, would you prefer an employee that can perform the job, or not?

Of course, this sidesteps the entire issue of whether we should be engaging in such things to begin with. Nations spying on other nations has occurr

I basically believe the information presented here, but the source could be anyone. It could be a complete work of fiction, and even if that is the case, it may still all be accurate. If someone asked me to come up with a laundry list of things that in all likelihood the feds have, I'd have easily come up with everything listed here.

In the last few years, every publicly known and patched bug makes almost no impact on us. They aren't scratching the surface.'

For some reason I doubt that private government workers, let alone government contractors, have discovered (let alone classified and organized) more bugs than the armies of security researchers out there to qualify as "barely scratching the surface". More likely the government is paying private security researchers for bugs and the promise of non-disclosure. Even then with how altruistic many researchers are, it's likely that kind of exchange would be exposed.

In the last few years, every publicly known and patched bug makes almost no impact on us. They aren't scratching the surface.'

For some reason I doubt that private government workers, let alone government contractors, have discovered (let alone classified and organized) more bugs than the armies of security researchers out there to qualify as "barely scratching the surface". More likely the government is paying private security researchers for bugs and the promise of non-disclosure. Even then with how altruistic many researchers are, it's likely that kind of exchange would be exposed.

it's likely they're paying for some bugs - but can't even verify if they work or under what circumstances. I seriously doubt that the fabricated person and his five thousand peers have anything to do with it though.

There's a lot of boasting yes, but as I understand it a lot of security bugs are discovered because they're being exploited. If you do all your hacking in a test lab and only use it sparingly and targeting specific computers it might take a long time before it ends up in any security researcher's lab. For example, take this recent bug [microsoft.com] from Microsoft, it affects every IE version back to IE6 - possibly older since they don't test further. Assuming it was in the original IE6 code base that's a bug the cyberwar division might have been sitting on for 12 years. Multiply that with lots and lots of top notch people and a system that don't disclose and (mostly) don't exploit, just hoard for a rainy day and I have no problem believing they have a pretty solid stash.

However that is also their biggest limitation, if you start using them they'll also become exposed so they're more like deep undercover agents. They're not going to "waste" them trying to catch the odd criminal, even if it's for serious crimes. They're military assets stockpiled for a cyberwar, like being able to crack the Enigma code during WWII. Some of it for espionage but I'm guessing most for being able to strike both physically and electronically at the same time, paralyze or even mislead their systems while you move in.

Security researches can't do reverse engineering or publish too soon what they find, at least if they are working in the open (think that don't applies to black hats). Government, in the other hand, have first hand [techweekeurope.co.uk] the information of exploits far before is patched, or even could get intentional backdoors [slashdot.org] in commercial software.

Anyway, patching a bug won't remove the already put backdoor in that computer, unless you do a clean reinstall after those bugs are fixed.

You have no idea the scale of this operation. They are buying the exploits and bugs by the 100's daily. There is soo many "security" research companies that only do this. They exploit and sell it to the government.

you got it wrong. there's hundreds of people who will privately imply that they do that - but they do it(implying) only to sell security services to their clients.

Foreign governments and educational institutions have access to the Windows sources, too.

How do they know it's the same source that was used to compile the binaries? And MS could just deploy a few more back doors any time, using their auto-update infrastructure.

I still think that a more likely place for intentionally placed exploits is in the CPU. Common operating systems have enough unintentional flaws for a long time, with more coming out very major release.

So, if what's being claimed is true (I'm doubtful), by not making these flaws public and giving vendors the chance to fix the issues, they are jeopardizing the domestic infrastructure they are ostensibly tasked to protect?

There's something profoundly inconsistent in this story, or profoundly hypocritical if it is true.

And he plays in a "hardcore rap/EDM band"? Either this person is an idiot for revealing something so specifically identifiable (even among "5000 people on my team", how many others of them are into it that much?), or they're spinning a yarn (misdirection or the whole story is nonsense).

" Most of the software written in the world has a bug every three to five lines of code. " Sure, buddy.

"It's all zero-days. Literally, if you can name the software or the controller, we have ways to exploit it. There is no software that isn't easily crackable. In the last few years, every publicly known and patched bug makes almost no impact on us. They aren't scratching the surface." Oookaaay, that sounds legit.

"My loft was up near the rafters, so I scooted over into the next storage area, climbed down" No lock-up facility I've been in has access through the roof space to the roof space into other units. Would you keep "$100,000 worth of computers, radio equipment, and oscilloscopes" in such a facility?

Dude could save the country and be a national hero. I can see CNN on election night 2016 now...

Wolf Blitzer: "In a shocking turn of events, not a single Republican or Democrat, or anyone on the ballot for that matter, won a single national election today. The entirety of the Senate is now made up of 20 random engineers, 15 doctors, 10 accountants, 10 school teachers, 10 construction workers, 5 disabled veterans, the 5 honest cops, and the rest are mexican day laborers. There's not a single lawyer or millionaire among them, and the new President is comedian Doug Stanhope."

This sounds like baloney, so I'll write some Walking Dead fan fiction.

You ever known a real fighter? I do. His name is Larry Ellison. Back when I headed to Atlanta, only to find a graveyard, I hooked up with some survivors camped outside the city. Best fucking luck I ever had. It was a few days later I met Ellison. He'd returned from scavenging in the city. I heard that most are in and out in a day - you don't want to risk staying overnight unless you really have to. This guy had been on his own in zombie c

It's like the war against government watch groups - the idea that by limiting what the government does (and increasingly the crony corporations that have cropped up to help it expend it's reach) - not fighting, but just calling out and limiting it, you are an enemy of the state and you need to be removed.

Exploits are bought/discovered and kept as armaments to be used on industrial/state espionage, and also for internal clandestine operations. So clearly anyone "invalidating" one by di

- he says he's middle aged - let's say 50. He also said at 16 or 17 he joined "one of the distros". The earliest "distros" as such, started appearing around 1992, IIRC - around 21 years ago. So at most he's now 37 or 38 - not middle aged.

Now if he just defines "middle aged" differently, then he would have been hanging at 15 around the Radio Shacks (a hacker cliche) around 1990 - well past the eras of the TRS-80s and Color Computers that the cliche says hackers would be work

Software developers have an incessant need to add features regularly in order to induce paid updates. Take Microsoft for example-- who needed a completely new UI in Windows 8? Only Microsoft. The only update features I ever need from Microsoft is stability/security/bug fixes. After about another 7 or 8 major rev levels of those, there would be some chance of having a system stable and secure enough to actually depend on-- but that'll never happen, as they're too busy monkeying with it in order to justif

As I said last week, the root cause which enables cyberwarfare is persistently insecure endpoints [slashdot.org] all over the internet. Each and every system out running linux, windows, mac osx, etc... all are based on an outdated and useless security model. Those nodes can then be used to attack or DOS anything that actually happens to be secure. Unless we shift everything to a system based on capabilities (and the principle of least privilege [wikipedia.org]) we're going to be in a "cyberwar" forever.

You talk as if the "government" was a monolithic entity. Its left hand very often doesn't even know its right hand even EXISTS, much less care what it does. Even worse, it may very well be that they don't want other government employees to patch those systems so they can spy on them, too!

If a hacker could hack into a megabank, airline, hotel chain, etc, how could you possibly pay them enough to ensure that not one of them makes a nice life for themselves?

well... by keeping them in a surveillance hell I suppose. he could still do it but he couldn't use any of it.

but the article smells like bullshit. tens of thousands of exploits ready to go to any controller(I suppose that means industrial controllers and such, fucking vcr's etc) and cracking any sw ever anywhere. fuck, there's some sw's that don't have enough of an attack vector at all. practically the only way it could be remotely true would be if they counted exploits they didn't even try and they counted platform exploits as exploits for sw on the platform(so, say java applet sandboxing has a hole in it = thousand exploits even if they're all the same). he's even claiming that no patched exploit used by malware authors affected their exploits in any way.

of course, it's infoworld - the bullshit heaven. the weakest defence the magazine had was the journalist. the fucking article starts with 15 year old as head of IT, then 16-17 year old having 100k worth of equipment for "hacking the airwaves" and just leaving it in a shed, it then downgrades to "I was writing buffer overflows and doing fuzzing" and watercooled computers in trucks.

Mr Grimes, go fuck yourself. either the facts are fabricated or the guy outed himself by the few details(15y head of it at federal hospital, spent time abroad with his mom) and the rest are just.. bullshit you could have made up. so where the fuck is the story?

tens of thousands of exploits ready to go to any controller(I suppose that means industrial controllers and such,

Doesn't sound lke bullshit to me. If you've ever worked with proprietary industrial crap, you will be aware that the manufacturers make great hardware and terrible software that they are inexplicably proud of.

I can well believe that the sort of software that you find out "oh no sorry if you have a local variable called x you get a hard lock and have to wait until the watchdog timer kicks in" is

They are at the bottom of the chain of watchers, so are watched too. But they know that if they want to take advantage of this and gets noticed, well, they should fly to Taiwan, and then get luckier than Snowden, that at least wasn't a criminal like them. Of course, the higher levels of the chain are unwatched, but they win enough in a way or another.

...If they have access to such awesome vulnerability detection software, why don't they run it on all the government's servers and applications?Sounds like shit.

because they WANT the chinese to have blueprints to their billion dollar jets. you know, that's only way to bankrupt them. also, why don't they hack iran's banking that provides funding for their nuclear program?

Just think how much safer our digital infrastructure would be, how everyone's privacy and data could be protected if, instead of hoarding exploits for use in an asinine "cyberwar", the US gov quietly released them to developers so their vulnerable software could be fixed. Fuckers.

Alternatively, what if software manufacturers actually tested their software before release with the same tools that the bad guys use, and made sure there were no bugs?

Or even better, wrote their software in a language that prevented entire classes of errors?

It would be nice if the concept of 'due diligence' applied to the people building the planetary brain.